TCP / IP Attacks

Computers use the TCP/IP protocol suite to manage internet communication. Unfortunately, certain TCP/IP functions can be exploited, resulting in network vulnerabilities.

TCP/IP is vulnerable to the following types of attacks:

Denial of Service (DoS)

DoS is a type of attack that generates an abnormally high volume of requests directed at network servers, such as mail or web servers. The goal of the attack is to completely overwhelm the server with illegitimate requests, thereby denying service to legitimate users.

Distributed DoS (DDoS) – A DDoS attack is similar to a DoS attack but is launched using a large number of computers—sometimes thousands. These computers are first infected with DDoS malware, turning them into "zombies" that form a "zombie army" or botnet. After infection, they remain dormant until they receive a command to initiate the DDoS attack. Since the zombie computers are located in various geographic locations, identifying the true source of the attack becomes difficult. SYN Flood – A SYN (synchronization) request is the initial message sent to establish a TCP connection. A SYN flood attack opens ports at the attack source and overwhelms a network device or computer with a large volume of fake SYN requests, resulting in a denial of service for others. A SYN flood attack is a type of DoS attack.

Spoofing – In a spoofing attack, a computer masquerades as a trusted computer to gain access to resources. The computer uses a fake IP or MAC address to pose as a machine authorized to access the network.

Man-in-the-Middle – An attacker carries out a Man-in-the-Middle (MitM) attack by intercepting communications between computers to steal information transmitted over the network. A MitM attack can also be used to manipulate messages and transmit false information between hosts, as the hosts remain unaware that the messages have been altered.

Replay – To execute a replay attack, transmitted data is intercepted and captured by an attacker. This data is then re-sent to the destination computer. The recipient's computer processes this data as authentic and originating from genuine sources.

DNS Poisoning

– DNS records within the system are altered to point to rogue servers. A user attempts to access a website, but the traffic is redirected to a malicious site. This rogue site is used to harvest confidential information, such as usernames and passwords; the attacker can then retrieve this information from the site.